Under the Mental Health Act, a minor who was responsible for the infamous hack that resulted in the online leak of footage from the next Grand Theft Auto VI game has been placed under indefinite detention. 18-year-old “key player” Arion Kurtaj of the Lapsus$ group went on a hacking rampage against big tech companies, including Rockstar Games, the company behind the wildly popular video game series.He took screenshots and codes from the unpublished Grand Theft Auto VI, the eagerly anticipated follow-up that will be available on storefronts in more than ten years. In September of last year, Kurtaj threatened to disclose the source code unless developer Rockstar got in touch with him. He also posted some of the stolen footage on internet forums. According to Judge Patricia Lees, the “hacking resulted in.
The judge ordered that he should be detained in hospital for an indefinite period of time under the Mental Health Act, with a restriction under Section 41, meaning he can only be discharged from hospital if the justice secretary approves it.
Kurtaj was sentenced alongside a 17-year-old boy, who cannot be named because of his age, who pleaded guilty to one offence under the Computer Misuse Act and one count of fraud, and was found guilty of one count of fraud, a charge of blackmail and having carried out an unauthorised act to impair the operation of a computer.
“You two were key players in what was a spree of cyber offending by a hacking group calling itself Lapsus$,” the judge said.
“That group targeted large technology companies and subjected them to hacking, blackmail and fraud.”
The court heard the youth was a member of the group between July 2021 and February last year when he was aged 15 and involved in offences against EE/BT and Nvidia – a hack which cost the company $5m (almost $4m) in remedial costs.
The child, who has been diagnosed with autism, viewed CCTV footage through a “audacious hack” into the City of London police system, according to the judge.
The teenager was also convicted of fraud and stalking offences in the youth court after using the email addresses of international government officials to send emergency disclosure requests to companies including Discord, Google and Uber to obtain personal details of those he targeted, the court heard.
He was given a juvenile rehabilitation order that included a six-month prohibition on using a VPN and an eighteen-month supervision requirement.
